City of St Paul Listed by interlock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 26, 2025, the City of St. Paul, Minnesota, appeared on a listing by the Interlock ransomware group. Public reporting indicates the group claims to have conducted a ransomware attack involving the exfiltration of internal files, with assertions that residents' data was compromised and that city infrastructure sustained damage. The number of people affected remains unknown, and independent confirmation of the full scope has not been detailed in available records.

This matters because municipal governments hold sensitive records on residents and operations. When a ransomware group lists a city government, it raises questions about potential exposure of personal and administrative information, even as many specifics stay unconfirmed.

Inside the incident

According to the available facts, the City of St. Paul was listed by Interlock in connection with a ransomware attack in which internal files were exfiltrated. The group's own statement, as reported, describes the city government, its representatives, and employees as careless with security, asserts that a large part of the infrastructure was damaged, and claims resulting losses and damage. It further states that residents whose data was compromised were placed in a particularly difficult position. Saint Paul has a population of about 310,992 and forms part of the Minneapolis–Saint Paul metropolitan area. No further public detail has been provided on the precise timing of the intrusion, the technical method used, the volume of data taken, or any ransom demand. The number of individuals affected is listed as unknown. The listing itself constitutes a claim by the group rather than independently verified confirmation of every asserted impact.

The group behind it: interlock

Interlock is a ransomware operation that has been documented in public cybersecurity reporting as employing double-extortion tactics: encrypting systems while also exfiltrating data and threatening to publish it if demands are unmet. The group typically posts victim names and sample claims on dedicated leak sites to apply pressure. It has been observed targeting organizations across sectors, including government and public entities, often focusing on environments where disruption of services can amplify leverage. Public knowledge of Interlock centers on these patterns of ransomware deployment combined with data theft and public listing; no additional claims specific to the City of St. Paul beyond the reported listing and accompanying statement are established in the facts. As with other such groups, listings are self-reported assertions that require separate verification.

About City of St Paul

The City of St. Paul is the capital of Minnesota and a municipal government serving roughly 311,000 residents within the larger Twin Cities metropolitan area. Like other city governments, it administers core public services including public safety, utilities, permitting, taxation, elections support, and resident records. Such organizations routinely maintain databases containing personal identifiers, addresses, financial interactions with the city, employment information for staff, and operational documents. A breach involving a municipal entity is consequential because it can affect both the continuity of essential services and the privacy of large numbers of ordinary residents who have no choice but to interact with local government for basic civic functions. Public detail on any specific security posture of the city prior to this listing is limited.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. The group's reported statement additionally claims that residents' data was compromised. Exact data types beyond the description "internal files" are not further itemized in the available record, and the number of people affected is unknown. Organizations of this kind typically hold a range of records such as resident contact details, property and tax information, employee personnel files, internal correspondence, and operational documents. Whether any of those categories were among the material taken remains unconfirmed. Public detail on the precise contents is therefore limited, and no specific personal data elements should be treated as verified exposures at this stage.

What's at stake

For residents, the primary risks center on the possibility that personal information could be misused for identity theft, targeted phishing, or other fraud if it was among the exfiltrated material. Even when exact contents are unconfirmed, the mere claim of resident data compromise can create lasting uncertainty and require individuals to monitor accounts and credit. For the city itself, a ransomware incident can disrupt administrative systems, delay services, and generate recovery costs, while also eroding public trust. Infrastructure damage asserted by the group, if accurate, could affect day-to-day operations. Because the scale remains unknown and many technical details undisclosed, the concrete impact on any given person or department cannot yet be quantified. The situation underscores the broader exposure that local governments face when holding large volumes of citizen data.

Were you affected?

If you live or work in St. Paul or have had dealings with the city government, treat the situation cautiously. Monitor financial statements and credit reports for unusual activity, be alert to unexpected communications that reference city services, and consider placing fraud alerts with major credit bureaus if you have reason for concern. Official notifications, if any are issued by the city, should be followed carefully. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Public detail on this incident remains limited, so verified updates from the city or independent investigators will be the most reliable source of further guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.